Chapter 23 -- Using Certificates

Chapter 23

In this final chapter, we'll finish our look at security with a topic that will become increasingly important and necessary over the next few years—the role of digital certificates as a form of user authentication. With organizations deploying extranets to tighten relationships with business partners, proper user authentication is critical. As the complexity of extranet applications increases and the sensitivity of the data being exchanged increases, organizations are looking beyond usernames and passwords for their user authentication mechanisms. Digital certificates can provide a more robust form of user authentication since they are installed into a user's browser and therefore tie authentication to an individual's PC rather than to a username and password that can be easily given out to others.

The Microsoft Windows NT 4.0 Option Pack includes Microsoft Certificate Server. This product allows organizations to become their own certification authority by managing the issuance, revocation, and renewal of digital certificates. These types of application are typically deployed in either intranets, extranets, or e-commerce applications where the data being exchanged is sensitive and can be accessed only by authorized individuals. Features in the Microsoft Internet Information Server (IIS) 4.0 Web server itself also allow for a more granular level of security setting than was previously possible in IIS 3.0 and earlier versions. This includes various configuration settings for how the Web server handles client-side certificates.

In this chapter, we'll start with some short background theory on public-key infrastructures and certification authorities and then progress through a discussion of Certificate Server, server-side and client-side certificates, and finally how to work with Active Server Pages (ASP) code to access both client-side certificates and Certificate Server functionality. At the end of this chapter, you'll be able to write applications using Microsoft Visual InterDev 6.0 that can leverage the full functionality of Microsoft Certificate Server and provide powerful user-authentication measures for your Web applications.